https://cybertoolchain.io/tools/feroxbuster New releases and features in feroxbuster, tracked by The Cyber Toolchain. en Sat, 13 Dec 2025 14:11:09 GMT https://github.com/epi052/feroxbuster/releases/tag/v2.13.1 https://github.com/epi052/feroxbuster/releases/tag/v2.13.1 Sat, 13 Dec 2025 14:11:09 GMT feroxbuster v2.13.1 adds smarter directory listing detection and skips web font extensions by default. • Adds new heuristics for identifying directory listing responses during content discovery. • Adds web fonts to the default ignored extensions list, reducing noise in scan results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.13.0 https://github.com/epi052/feroxbuster/releases/tag/v2.13.0 Fri, 10 Oct 2025 22:47:09 GMT feroxbuster v2.13.0 adds --scope filtering and STATE_FILENAME env var for state file control • Adds `--scope` option to restrict feroxbuster crawling to explicitly defined in-scope targets • Adds `STATE_FILENAME` environment variable to control the name and location of feroxbuster's state file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.12.0 https://github.com/epi052/feroxbuster/releases/tag/v2.12.0 Mon, 01 Sep 2025 11:52:22 GMT feroxbuster v2.12.0 adds response size limiting, SimHash duplicate filtering, and auto Content-Type POST flags • Adds `--response-size-limit` flag to cap response body reads (default 4 MB), preventing memory exhaustion against targets that return very large responses • Adds `--unique` flag to filter duplicate responses using SimHash with Hamming distance analysis, reducing noise from similar pages across large applications • Adds `--data-json` flag that auto-sets `Content-Type: application/json`, switches method to POST, and accepts payloads or `@filename` references • Adds `--data-urlencoded` flag that auto-sets `Content-Type: application/x-www-form-urlencoded`, URL-encodes the payload, switches method to POST, and accepts `@filename` references • Enhances the interactive scan management menu with real-time view and modification of scan limits, plus a new 'Waiting' status for queued scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.11.0 https://github.com/epi052/feroxbuster/releases/tag/v2.11.0 Sun, 15 Sep 2024 11:27:22 GMT feroxbuster v2.11.0 adds raw Burp request file input, directory-listing recursion, and progress bar limits. • New `--request-file` flag reads a raw HTTP request file (e.g. from Burp Suite) to drive scans without manually reconstructing flags. • New `--protocol` flag works alongside `--request-file` to specify the protocol when using raw request files. • New `--scan-dir-listings` flag forces feroxbuster to recurse into directories where directory listing is enabled, catching exposed folder trees. • New `--limit-bars` flag caps the number of concurrent progress bars displayed, reducing terminal noise on large scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.10.4 https://github.com/epi052/feroxbuster/releases/tag/v2.10.4 Sun, 16 Jun 2024 20:03:28 GMT feroxbuster v2.10.4 adds header filtering to `--filter-regex`, ARM macOS builds, and scan progress UI • `--filter-regex` now evaluates HTTP response headers in addition to the body. • Added ARM build for mac (`aarch64-macos`) to official releases. • Scan management menu displays estimated time left during active scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.10.3 https://github.com/epi052/feroxbuster/releases/tag/v2.10.3 Sat, 27 Apr 2024 11:08:21 GMT feroxbuster v2.10.3 adds JSON log improvements, config state persistence, and implicit POST for --data • Improved JSON logs structure to facilitate post-processing workflows. • Persisted the current configuration field into the state file for session recovery or auditing. Breaking changes: • The `--data` flag now implicitly sets the HTTP verb to POST, which may alter behavior if used with endpoints expecting GET. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.10.2 https://github.com/epi052/feroxbuster/releases/tag/v2.10.2 Fri, 01 Mar 2024 13:02:45 GMT v2.10.2 adds `--collect-backups` custom extension support and improves parallel time limit enforcement • `--collect-backups` flag now accepts a custom comma-separated list of file extensions for backup files • `--parallel` time limit is now enforced per-directory rather than across the main thread, preventing early termination of sub-scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.10.0 https://github.com/epi052/feroxbuster/releases/tag/v2.10.0 Sat, 06 May 2023 13:19:20 GMT Adds `--server-certs`, `--client-cert`, and `--client-key` flags to enable mTLS support in feroxbuster • Adds `--server-certs`, `--client-cert`, and `--client-key` CLI arguments to manage server and client certificates, enabling mutual TLS (mTLS) connections Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.9.4 https://github.com/epi052/feroxbuster/releases/tag/v2.9.4 Thu, 20 Apr 2023 11:50:25 GMT Adds optional install path to `install-nix.sh` script • Adds optional install path to `install-nix.sh` script Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.9.3 https://github.com/epi052/feroxbuster/releases/tag/v2.9.3 Wed, 12 Apr 2023 00:28:11 GMT Auto filtering now uses extensions and status codes in its decision calculus • `feroxbuster` incorporates target URL extensions and HTTP response status codes into the auto-filtering algorithm to reduce false positives during directory enumeration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.9.2 https://github.com/epi052/feroxbuster/releases/tag/v2.9.2 Sat, 18 Mar 2023 17:21:28 GMT Feroxbuster v2.9.2 adds `--dont-extract-links` flag and supports loading wordlists from HTTP/HTTPS URLs. • Adds `--dont-extract-links` CLI flag to override the new default `--extract-links=true` behavior • Supports loading wordlists directly via HTTP or HTTPS URLs (previously only local files or `-u` targets were supported) Breaking changes: • The default value for `--extract-links` has changed to `true`; users who previously relied on the implicit `false` default must now explicitly pass `--dont-extract-links`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.9.1 https://github.com/epi052/feroxbuster/releases/tag/v2.9.1 Sun, 12 Mar 2023 12:32:10 GMT ferso v2.9.1 adds an auto-update feature, chocolatey installer support, and the ability to cancel active scans via UI or stdin. • `feroxbuster` now includes a built-in auto-update mechanism • New `-u` and `--stdin` flags are now cancellable from the interactive menu, adding `canx` as an operation for live scan management • Added Chocolatey installation support (`choco install feroxbuster`) alongside existing package managers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.8.0 https://github.com/epi052/feroxbuster/releases/tag/v2.8.0 Tue, 28 Feb 2023 21:59:33 GMT fersu v2.8.0 adds visual cues for auto-tune and auto-bail, new `simhash` similarity filter, and resume-scan from offset. • `--resume-from-offset` flag now accepts a start index to continue a directory scan from a specific wordlist position • auto-bail triggers a new visual notification in the terminal UI when rate limiting is enforced • auto-tune rate adjustments are now accompanied by visible feedback in the status line • similarity filters use `simhash` instead of `ssdeep` for more reliable response deduplication • new 404-like response detection methods improve filtering of false positives while allowing API responses through Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/2.7.1 https://github.com/epi052/feroxbuster/releases/tag/2.7.1 Thu, 12 May 2022 11:12:39 GMT Feroxbuster 2.7.1 adds automatic https prepending, leading-period stripping on -x extensions, and a secondary default wordlist path. • Prepends `https` to URLs when no scheme is provided in `-u` • Strips leading periods from extension values passed via `-x` so `.php` and `php` are identical • Supports `/usr/local/share/seclists` as a secondary default wordlist location Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/2.7.0 https://github.com/epi052/feroxbuster/releases/tag/2.7.0 Fri, 15 Apr 2022 11:11:47 GMT Adds `--force-recursion` flag and overhauls status code filtering with mutually exclusive `--filter-status`. • Adds `--force-recursion` flag to ignore typical recursion logic and recurse into any found asset • Makes `--filter-status` and `--status-codes` mutually exclusive options for status code handling • Updates default wordlist path on Windows to `.\SecLists\Discovery\Web-Content\raft-medium-directories.txt` Breaking changes: • `--filter-status` and `--status-codes` are now mutually exclusive; you can no longer use them together in the same invocation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.6.2 https://github.com/epi052/feroxbuster/releases/tag/v2.6.2 Thu, 07 Apr 2022 12:08:21 GMT feroxbuster v2.6.2 adds filter management within the interactive Scan Management Menu. • Adds the ability to add and remove filters directly via the `Scan Management Menu` during an active scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.5.0 https://github.com/epi052/feroxbuster/releases/tag/v2.5.0 Mon, 17 Jan 2022 13:54:33 GMT fersobuster v2.5.0 adds `-b` for cookies, multiple HTTP methods during scan, directory listing scraping, and redirect messages in reports • `-b` flag to specify cookies for the scanned target • Support for specifying multiple HTTP methods during a single scan • Automatic extraction of links from directory listings and web pages via directory listing & web scraping • Redirect URLs are now included in normal (non-SARIF/JSON) report outputs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster https://github.com/epi052/feroxbuster/releases/tag/v2.4.1 https://github.com/epi052/feroxbuster/releases/tag/v2.4.1 Sun, 19 Dec 2021 20:02:08 GMT Adds original_url to JSON output and revised cancel management menu for new scan addition • Adds `original_url` field to JSON output • Revises Scan Cancel Management Menu to allow adding a new scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/feroxbuster